This is yet another example of simple security errors resulting in mass hacks of websites. The attackers ultimate purpose is the installation of trojans onto end user machines. The trojans are then used in bot armies, or for collection of data, passwords and financial accounts from keystroke loggers.
As more and more websites are using database back-ends to make them faster and more dynamic, it also means it is crucial to verify what information gets stored in, or requested from, those databases — especially if users are allowed to upload content themselves which happens all the time in discussion forums, blogs, feedback forms, and other area of dynamic websites.
Unless that data is sanitized before it gets saved, it is impossible to control what the website will show to the users. This is what SQL injection is all about, exploiting weaknesses in these controls.